User:HijackThis Nerd/Vundo

Vundo Removal

With malware reports on the rise, one of the most common infections reported is the Vundo trojan. It has been common for the last half-year, and is incredibly annoying with advertisements for things like SysProtect and WinFixer, both of which are phony and do not work. The creater of Vundo, also known as Virtumundo, Virtumondo, Virtumonde, etc., wants money, but instead of working hard for it he just uses cheap tricks to get it. Therefore, it is imperative that you know how to rid your computer of this pest.

• Download one of the following programs: VundoFix -- VirtumondeBeGone -- FixVundo -- Virtumonde Remover by Lavasoft. VundoFix is the most widely used and is my personal favourite. If VundoFix doesn't work, VirtumondeBeGone should.
• Download HijackThis v 1.99.1 from MajorGeeks.com. After you have extracted it, right-click on it and select "Rename". Rename it to anything without HijackThis in the name (such as scanner.exe, asdf.exe, etc.exe, etc).
• Open it up and do a scan only. Scroll down the list, there should be items with things that start with things like O2, O3, O20, etc. Some people will have things like R1 and R2; others will have F1 and F0. If you have an F0 item, it is always bad; visit one of the support forums at the bottom of the page and post a log there. Usually, people will not have O1s.
• Look for something like this, keeping in mind that Vundo generates random *.dll files with random consanant names:

O2 - BHO: (no name) - {0A90D44E-CDE8-4607-A2A7-D5A940164467} - C:\WINDOWS\system32\vtstt.dll
O20 - Winlogon Notify: pmnmmjg - C:\WINDOWS\SYSTEM32\pmnmmjg.dll
O20 - Winlogon Notify: vtstt - C:\WINDOWS\system32\vtstt.dll

• Note: You may encounter files which say things like:

O20 - Winlogon Notify: skdgsvs - C:\WINDOWS\SYSTEM32\skdgsvs.dll (no file)
O2 - BHO: (no name) - {0A90D44E-CDE8-4607-A2A7-D5A940164467} - C:\WINDOWS\system32\stplp.dll (file missing)

• In either case, remove all the entries that are like that (check them off and press "Fix Checked"). If you have Vundo, chances are you have more infections in your computer, so post at one of the forums listed at the bottom of the page.

I hope this information has helped to rid your computer of crappy junk :) Keep your computer clean by using a firewall, antivirus, Ad-Aware, and Spybot every now and then.

Support Forums

• AfterDawn - Windows and Spyware Problems. My forum of choice.
• BleepingComputer's "Am I Infected"? forum
• MalwareRemoval.com
• Removal guide using VundoFix

There are many, many more, but I don't feel like listing them at this particular second.